(HP Issues Preliminary Fix for HP-UX) Mozilla Browser Suite Integer Overflow in CSS Letter-Spacing Property Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016187 |
|
SecurityTracker URL: http://securitytracker.com/id/1016187
|
|
CVE Reference:
CVE-2006-1730
(Links to External Site)
|
Date: May 31 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 1.7.13
|
Description:
A vulnerability was reported in the Mozilla Browser Suite. A remote user can execute arbitrary code on the target system.
A remote user can create HTML with a specially crafted CSS letter-spacing property value that, when loaded by the target user, will trigger an integer overflow and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
TippingPoint reported this vulnerability.
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
HP has issued preliminary versions of Mozilla 1.7.13 for HP-UX, available at:
ftp://ftp.mozilla.org/pub/mozilla.org/mozilla/releases/mozilla1.7.13/contrib/
mozilla1.7.13-hppa2.0w-hp-hpux11.00.depot.gz
mozilla1.7.13-hppa2.0w-hp-hpux11.00.depot.readme
mozilla1.7.13-ia64-hp-hpux11.22.depot.gz
mozilla1.7.13-ia64-hp-hpux11.22.depot.readme
The HP advisory is available at:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00679472
|
Vendor URL: www.mozilla.org/security/announce/2006/mfsa2006-22.html (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (HP/UX)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 31 May 2006 00:57:43 -0400
Subject: HPSBUX02122 SSRT061158 rev.1 - HP-UX Mozilla Remote Execution of Arbitrary Code, Denial of Service (DoS)
|
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00679472
See:
MFSA 2006-27 Table Rebuilding Code Execution Vulnerability
MFSA 2006-25 Privilege escalation through Print Preview
MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
MFSA 2006-23 File stealing by changing input type
MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
MFSA 2006-21 JavaScript execution in mail when forwarding in-line
MFSA 2006-19 Cross-site scripting using .valueOf.call()
MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
MFSA 2006-17 cross-site scripting through window.controllers
MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent
MFSA 2006-14 Privilege escalation via XBL.method.eval
MFSA 2006-13 Downloading executables with "Save Image As..."
MFSA 2006-12 Secure-site spoof (requires security warning dialog)
MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
MFSA 2006-10 JavaScript garbage-collection hazard audit
MFSA 2006-09 Cross-site JavaScript injection using event handlers
MFSA 2006-05 Localstore.rdf XML injection through XULDocument.persist()
MFSA 2006-03 Long document title causes startup denial of Service
MFSA 2006-01 JavaScript garbage-collection hazards
|
|
